Cloud-based computer system providers allow for certain resources to be accessed by computing devices over a network. Data storage is one example of such a resource provided for access by cloud-based computer systems. Cloud-based applications are another example of such a resource; the applications may be deployed and managed using networked computer systems to access data stored in a cloud-based data store.
Users are provided with various levels of access to the above-described resources. The various levels of access facilitate resource management and also provide resource security. For example, certain users are merely authorized to manage the deployment of a cloud-based application to a network, while other users are authorized to manage the application itself. However, if an excessive number of users authorized to manage deployment are granted authorization to manage the application itself, security of the stored data as well as security of the application is more likely to be compromised.
Another example of the need to provide resource security is evident in the recognition that the stored data managed by the cloud-based computer system comprises a series of physical hard drives. In the event the physical hard drive is stolen, or a hacker gains access to the hard drives through an authorized local network or by other means, sensitive configuration information on the hard drive is more likely to be compromised. More specifically, the physical hard drive contains certain resource-related data used to configure a cloud-based application. This configuration data is also capable of being used to locate and access the stored data, and is typically output in an unencrypted form as plain text into a log when the application reads the configuration data during the configuration process. Allowing users that are authorized to manage deployment to see the logs containing the configuration data also degrades the security of the stored data.
Current providers of cloud-based computer systems employ traditional methods of securing data transmitted by the networked system, such as by restricting access to certain resources based on whether the user is authorized to access the resource itself. Current providers also protect communications by uploading certificates in order to protect a runtime upload channel and/or by monitoring the channel in order to detect whether networked communications have been intercepted, such as during a “Man-in-the-Middle” attack. Each of these methods may protect access to cloud-based resources in some manner, but they do not adequately protect certain resource-related data used to configure the application, or address concerns related to protecting data output to logs in the manner described above.